Windows 11 24H2 · 1.0

[added: ]This setting enables and configures the device-based tenant restrictions feature for Azure Active Directory.[removed: ][added: ]When you enable this setting, compliant applications will be prevented from accessing disallowed tenants, according to a policy set in your Azure AD tenant.[removed: ][added: ]Note: Creation of a policy in your home tenant is required, and additional security measures for managed devices are recommended for best protection. Refer to Azure AD Tenant Restrictions for more details.[removed: ][added: ]https://go.microsoft.com/fwlink/?linkid=2148762[removed: ][added: ]Before enabling firewall protection, ensure that [removed: a Windows Defender Application Control (WDAC) ][added: an App Control for Business ]policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding [removed: WDAC][added: App Control for Business] policy will prevent all applications from reaching Microsoft endpoints. This firewall setting is not supported on all versions of Windows - see the following link for more information.[removed: ][added: ]For details about setting up WDAC with tenant restrictions, see https://go.microsoft.com/fwlink/?linkid=2155230

This policy setting allows you to configure how File Explorer displays thumbnail images or icons on network folders. File Explorer displays [added: only icons and never displays ]thumbnail images on network folders by default. If you [removed: en][added: dis]able this policy setting, File Explorer displays [removed: only icons and never displays ]thumbnail images on network folders. If you [removed: dis][added: en]able or do not configure this policy setting, File Explorer displays only [added: icons and never displays ]thumbnail images on network folders.[added: Note: Allowing the use of thumbnail images from network folders can expose the users' computers to security risks.]

Define evidence file remote location, where Device Control service will move evidence data captured.[added: When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access.]

This policy setting allows you to configure the [added: randomization of the ]scheduled [removed: scan,][added: scan start time] and the scheduled [removed: security intelligence update, ][added: definition update ]start [removed: time window in hours. ][added: time. ]If you [removed: dis][added: en]able or do not configure this [added: policy ]setting, [removed: scheduled tasks will begin at a random][added: and did not set a randomization window in the Configure scheduled task] time [removed: within 4 hours after the time specified in Task Scheduler. ][added: randomization window setting , then randomization will be added between 0-4 hours. ]If you enable [added: or do not configure ]this [added: policy ]setting, [removed: you can widen, or narrow, this][added: and set a randomization window in the Configure scheduled task time] randomization [removed: period. Specify a][added: window setting, the configured] randomization window [removed: of between 1 and 23 hours.][added: will be used. If you disable this policy setting, but configured the scheduled task time randomization window, randomization will not be done. ]

This policy setting allows you to configure scheduled [added: task ]scan start time and the scheduled security intelligence update start time window in hours.[removed: ][added: This setting affects the Randomize scheduled task times configuration. ]If you [removed: disable or do not configure this setting, scheduled tasks will begin at a random time within an][added: enable this setting, you must pick a randomization window in hours. The possible randomization window interval is between 1 and 23 hours. The randomization] interval [removed: of 4 hours after][added: implemented is between 0 and] the [removed: specified start time. If ][added: configured value. When ]you enable this setting, [removed: you must pick a][added: Randomize scheduled task times settings uses the] randomization window [added: specified ]in [removed: hours. The possible randomization window interval is between 1 and 23][added: this configuration setting. If you disable or do not configure this policy setting, Randomize scheduled task times settings will randomize scheduled task times between 0-4] hours.

This policy specifies the path to a file [removed: (e.g. either stored ][added: (stored ]locally or on a network location) that contains file type and protocol default application associations. This file can be created using the DISM tool.[removed: ][added: ]For example: Dism.exe /Online /Export-DefaultAppAssociations:C:\AppAssoc.txt For more information, refer to the DISM [removed: documentation on TechNet. If this group policy][added: documentation. The file can be further edited after it] is [removed: enabled and][added: created to change how often] the [removed: client machine is domain-joined,][added: policy associations are applied. A "Version" attribute can be added to] the [removed: file will][added: "DefaultAssociations" element. The value should be an integer. A "Suggested" attribute can be added to any "Association" element. The value should] be [removed: processed][added: a bool] and [added: the ]default [removed: associations][added: value is "false". When the policy is applied to a user, any Association that has Suggested="true"] will [removed: be][added: only get] applied [removed: at logon time.][added: once. If the Version value is ever incremented, Associations with Suggested="true" will get reapplied.] If [removed: the][added: this] group policy is [removed: not configured, disabled, or ][added: enabled and ]the client machine is [removed: not domain-joined, no][added: domain-joined, the file will be processed and] default associations will be applied at logon time. If the policy is enabled, [removed: disabled, or not configured, ]users will still be able to override default file type and protocol [removed: associations.][added: associations, but on next logon the file will be reapplied.]

Turning off this setting will prevent File Explorer from requesting cloud file metadata and displaying it in the homepage and other views in File Explorer. Any insights and files available based on account activity will be stopped in views such as Recent, Recommended, Favorites, [added: Details pane, ]etc.